ONE STOP SYSTEMS, INC.

Risks Related to Cybersecurity Incidents

We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

Specific risks include:

•

Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities.

•

Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.

•

Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, which would impact our competitive position in the market.

•

Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.

•

Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.

Our systems are often deployed in environments supporting AI workloads and large-scale data processing. Unauthorized access to such systems could expose sensitive operational or training data belonging to our customers.

Although cybersecurity incidents havenot materially impacted our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not do so in the future.

Risk Management and Strategy

Assessing, Identifying, and Managing Material Cyber Threats

We have implemented infrastructure, systems, policies, and procedures designed to proactively and reactively address cybersecurity incidents. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management experts, on our risk management strategy. Weengage outside vendors and utilize government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics support our efforts to identify and manage cyber threats.

When a cyber incident is detected through our 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment, identifies the source of the problem, and resolves the issue as appropriate. If resolution cannot be achieved, the problem is escalated to our cybersecurity monitoring and detection software provider. Events that our IT and cybersecurity providers do not routinely resolve are brought to the Board's attention.

Critical business and operational data are backed up nightly and securely stored offsite to mitigate the risks of cybersecurity incidents or equipment failure. We provide cybersecurity awareness training to our employees, incident response personnel, and senior management.

Governance

Our management team, including our Vice President of Technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises our internal cybersecurity and IT personnel and our retained external cybersecurity consultants and vendors. They oversee efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through briefings from internal or external security personnel, threat intelligence obtained from governmental, public, or private sources, and alerts and reports produced by security tools deployed in our IT environment.

Our Board of Directors, through its Audit & Risk Committee, provides oversight of management processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our Vice President of Technology and our Audit & Risk Committee members, regularly brief our Board on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact.

As cyber threats evolve and become more sophisticated, the Board's involvement in cybersecurity governance ensures that we adequately focus resources to protect the Company's assets and reputation.

Key aspects of our cybersecurity governance include:

•

Governance and Strategy: Management, the Audit & Risk Committee, and the Board ensure that our cybersecurity strategy is aligned with our business strategy.

•

Risk Management and Oversight: Our Audit & Risk Committee and the Board actively oversee our cybersecurity risk management framework as part of enterprise risk management oversight, ensuring that material risks are identified, assessed, and mitigated.

•

Resource Allocation: The Board reviews and approves cybersecurity budgets and resource allocations to ensure adequate resources are available to implement and maintain effective cybersecurity measures. The Board evaluates and approves significant investments in cybersecurity technologies, training, and talent based on recommendations from management and our external vendors and consultants.

•

Compliance and Legal Obligations: Management and the Board oversee compliance with relevant cybersecurity regulations and legal requirements and ensure we have appropriate legal counsel to address cybersecurity-related issues, including incident notification requirements. Management has identified the need to further comply with government Cybersecurity Maturity Model Certification (CMMC) requirements that became effective on November 9, 2025, which will include formal external assessment of cybersecurity controls and policies used to manage Controlled Unclassified Information (CUI) within the Company. We anticipate increased demands from government and government prime contractor customers who entrust CUI to us during the normal course of business. The initial and ongoing cost of this compliance will be an additional budgeted IT expense in future years.

•

Education and Awareness: Management and the Board stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. Management reviews Company employee training programs to ensure employees receive appropriate training and updates on evolving cyber trends. Certain Board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.

•

Reporting and Communication: The Board receives periodic updates from management, responsible staff, and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts. Management and the Board maintain a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.

•

Performance Evaluation: The Board's annual evaluation of the Chief Executive Officer's performance includes assessing the effectiveness of cybersecurity policy implementation and ensuring that cybersecurity policies and practices are effective and aligned with organizational goals.

•

Cybersecurity Culture: The Board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts tointegrate risk management, including cybersecurity, into the operating culture.

Ongoing Initiatives

Management and the Board are evaluating and intend to implement further cybersecurity-related measures throughout 2026 and beyond, including developing a more robust internal policy framework, incident response plan, crisis management planning, and third-party vendor assessments and contractual obligations. Despite these efforts, the rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents.